Technology & Digital Tools Flashcards
7 cards from real CPI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Technology & Digital Tools flashcards as text
An investigator discovers that a key piece of evidence was stored on a solid-state drive (SSD). Why is data recovery from SSDs more challenging than from traditional hard drives?
Answer: The TRIM command causes the OS to immediately wipe deleted data blocks
The TRIM command instructs the SSD controller to zero out blocks when files are deleted, making recovery of deleted data significantly harder than on mechanical drives.
Which technique do investigators use to identify and track an online suspect across multiple platforms by analyzing consistent patterns in their usernames, writing style, or behavior?
Answer: Behavioral attribution
Behavioral attribution connects disparate online accounts by identifying consistent linguistic, stylistic, or behavioral patterns unique to an individual.
Under the Electronic Communications Privacy Act, which legal instrument is required for law enforcement to compel a provider to disclose the content of emails stored for MORE than 180 days?
Answer: A search warrant
Under ECPA (as interpreted by most courts following the Sixth Circuit's Warshak decision), a search warrant supported by probable cause is required to compel disclosure of email content.
A digital evidence collection team arrives at a scene where a desktop computer is running. What should the team do FIRST?
Answer: Photograph the screen and collect volatile memory (RAM) before shutdown
Volatile memory contains active processes, network connections, and encryption keys that are lost on shutdown, so live RAM capture must be prioritized before powering down.
Which internet protocol record type, when queried, reveals the mail servers responsible for accepting email on behalf of a domain?
Answer: MX record
An MX (Mail Exchanger) record in DNS specifies the mail servers authorized to accept inbound email for a domain.
When an investigator uses a 'burner' phone purchased with cash to conduct undercover communications, which identifier can STILL potentially link the phone to the investigator?
Answer: Both A and B
Even an anonymously purchased phone reveals its IMEI at network registration, and calling patterns near known locations can link the device to the investigator through cell tower records.
What is the primary purpose of maintaining a detailed forensic examination log during a digital investigation?
Answer: To document every action taken on the evidence so findings can be independently reproduced
A forensic examination log creates a reproducible record of every step taken, allowing peer review, court testimony, and challenge by opposing experts.